CVE-2026-59936: CVE-2026-59936: Infinite Loop in pypdf Inline Image Parser Leads to Denial of Service

#security #cve #cybersecurity

CVE-2026-59936: Infinite Loop in pypdf Inline Image Parser Leads to Denial of Service

Vulnerability ID: CVE-2026-59936
CVSS Score: 8.7
Published: 2026-07-23

An infinite loop vulnerability exists in the pure-python PDF library pypdf prior to version 6.14.1. This vulnerability occurs during the processing of malformed or truncated page content streams containing inline images. Specifically, the parser fails to validate the End-of-Stream condition during inline image dictionary parsing. This results in continuous backward stream-seeking and an infinite loop that consumes 100% CPU on the processing thread.

TL;DR

A flaw in the inline image parsing logic of pypdf versions prior to 6.14.1 allows an unauthenticated remote attacker to cause a complete Denial of Service (100% CPU thread utilization) by submitting a malformed PDF with a truncated inline image block.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-400
Attack Vector: Network
CVSS v4.0 Score: 8.7
EPSS Score: 0.00345
Impact: Denial of Service (DoS)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

Applications utilizing the Python library pypdf to extract text, images, or metadata from untrusted PDF files.
pypdf: < 6.14.1 (Fixed in: 6.14.1)

Code Analysis

Commit: ec3b145

Possible infinite loop for not terminated inline images in pypdf

@@ -1395,6 +1395,8 @@ def _read_inline_image(self, stream: StreamType) -> dict[str, Any]:
         settings = DictionaryObject()
         while True:
             tok = read_non_whitespace(stream)
+            if not tok:
+                raise PdfStreamError("Unexpected end of stream.")
             stream.seek(-1, 1)
             if tok == b"I":
                 # "ID" - begin of image data

Exploit Details

GitHub Test Suite: The official PR includes an integration test demonstrating how feeding a malformed, truncated content stream to _read_inline_image leads to an infinite loop in vulnerable versions.

Mitigation Strategies

Upgrade pypdf to version 6.14.1 or higher.
Implement hard execution timeouts on all backend PDF processing tasks.
Isolate PDF parsing workloads within restricted container environments with CPU resource limits.

Remediation Steps:

Identify all internal services and applications utilizing the pypdf library.
Update the project dependencies (requirements.txt, Pipfile, or poetry.lock) to reference pypdf>=6.14.1.
Deploy the updated application package to production environments.
Configure processing queues to enforce a maximum execution duration per document.

References

Read the full report for CVE-2026-59936 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community